Summary
- Bridewell recorded 2,889 ransomware victim postings in Q3 2026, compared with 1,609 a year earlier.
- Manufacturing represented 16.4% of the total, with Germany and the UK prominent among European countries.
- The dataset contained 111 active groups, including many low-volume operators, but does not establish that every claimed attack succeeded.
Manufacturing accounted for the largest share of ransomware victim postings during the third quarter of 2026, as new research recorded an 80% annual increase in organisations publicly named by ransomware and extortion groups.
Cybersecurity company Bridewell identified 2,889 victim postings across 111 active groups during the quarter, compared with 1,609 in the equivalent period of 2025.
The findings were published on 29 October by Bridewell’s BCON Collective threat research team and are based primarily on data collected from criminal leak sites through Ransomware.live.
These postings represent public claims made by ransomware and extortion operators. They do not independently establish that every named organisation suffered a successful intrusion or that each claim corresponds to a newly confirmed attack.
Manufacturing accounted for 16.4% of the monitored total, equivalent to 474 victim postings. Professional services followed with 392 and technology with 363.
Healthcare was also prominently represented, with 285 recorded postings, while the wider dataset spanned 13 industry sectors and 121 countries.
Industrial businesses remain prominent targets
Manufacturing environments often depend on interconnected administrative, engineering, production, and logistics systems. Disruption to one part of that environment can affect operations elsewhere, particularly when production planning relies on centrally managed business applications.
An intrusion affecting enterprise systems may interrupt order processing, procurement, scheduling, or the exchange of technical information with customers and suppliers.
Where operational systems are involved, recovery can require additional consideration of plant availability, equipment integrity, and the safe restoration of affected processes.
The sector’s prominence in Bridewell’s figures does not establish that industrial control systems were compromised in each case. Many ransomware incidents initially affect ordinary enterprise infrastructure rather than production equipment.
However, industrial organisations often handle commercially sensitive drawings, contracts, customer information, and supplier records that may be valuable to extortion groups even when production remains operational.
The risk therefore extends beyond file encryption. Criminal groups increasingly threaten to disclose stolen information, creating a potential second phase of damage after access to operational systems has been restored.
Smaller ransomware groups add to fragmentation
Bridewell identified 111 active ransomware and extortion groups during Q3, compared with 86 in the equivalent period of 2025.
Of those observed, 47 groups published fewer than 10 victims, representing approximately 42% of the total number of active groups.
The top 10 groups accounted for 48% of all recorded victim postings, indicating that established operators continue to dominate a substantial share of publicly visible activity even as smaller groups enter the monitored ecosystem.
Qilin was the most prolific operator, with 362 claimed victims. The Gentlemen followed with 360.
The number of group names does not necessarily correspond to the number of independent criminal organisations. Rebranding, changing affiliates, and overlapping operations can complicate attribution and longitudinal comparisons.
The distribution of claims can also be affected by the speed at which individual groups publish victim information, including disclosures made after the original intrusion occurred.
European exposure remains substantial
The United States accounted for 34.7% of the reported victims, while several European countries featured prominently in the rankings.
Germany recorded 154 postings, placing it second internationally, while the United Kingdom ranked third with 111. Italy recorded 103, France 64, and Spain 50.
These figures describe the reported locations of victim organisations, not the origins of the attackers.
Bridewell’s dataset also showed a 26% quarter-on-quarter increase in victim postings. The rise occurred alongside an increase in the number of active criminal group names, suggesting broader participation in the monitored leak-site ecosystem.
Such measurements provide useful information about the public behaviour of ransomware groups, but they do not capture every intrusion. Some incidents are never disclosed, while others involve disputed or fabricated claims.
Manufacturing’s leading position in the quarterly data reinforces the sector’s visibility within ransomware extortion activity. The full scale of successful attacks remains less certain than the publicly recorded postings suggest.
